Most adversarial examples are brittle in a way that matters. Optimize a perturbation against a single rendering of an image and it will often collapse the moment the image is rescaled, rotated a few degrees, printed, or photographed again. For a threat model that lives entirely in the digital domain, that brittleness is irrelevant. For overhead and aerial perception, where the model consumes real captures taken from varying altitudes, angles, and lighting, it is the whole problem.
The physical-realizability gap
The jump from digital to physical attacks was made rigorous by Athalye and colleagues, whose Expectation over Transformations (EOT) framework is now the foundation of the field. The idea is deceptively simple: instead of maximizing the adversarial objective for one fixed rendering, maximize it in expectation over a distribution of transformations the input will actually undergo. Sample random scales, rotations, brightness shifts, and noise; average the gradients; and the resulting perturbation is optimized to remain adversarial across the whole distribution, not at a single lucky operating point.
In parallel, Eykholt and colleagues' Robust Physical Perturbations (RP²) attacked the same challenge, environmental variability, from the road, producing perturbations on stop signs that survived real drive-by capture. Brown and colleagues showed that a single, printable adversarial patch could dominate a classifier's prediction regardless of the scene around it. Thys and colleagues extended patches to person detection. The common thread is optimization over transformations, and it generalizes directly to the overhead case.
The right question is never 'does the perturbation fool the model?' It is 'does it still fool the model after the world has had its way with it?'
Why overhead is its own problem
Overhead imagery breaks several assumptions that hold for ground-level vision. Objects are small relative to the frame, often only tens of pixels across in a scene that spans thousands. They appear at arbitrary orientation, which is why models trained on datasets like DOTA use oriented bounding boxes rather than axis-aligned ones. And a single capture can span kilometers, so running one forward pass over a downsampled frame throws away exactly the resolution that small objects need.
Detection accuracy on these frames is dominated by a preprocessing decision, not the model: tiled inference. Slicing a large frame into overlapping tiles, running detection per tile at native resolution, and merging the results with non-maximum suppression keeps small objects large relative to each tile. It is the single biggest lever on baseline detection quality, and any honest adversarial evaluation has to sit on top of a strong baseline, or it is measuring the wrong thing.
What a credible evaluation looks like
Bringing this together, a physical adversarial evaluation for overhead detection has to do more than report a single success number:
- Establish a strong baseline with tiled, oriented-box detection at native resolution.
- Optimize patches and camouflage with EOT over a transform distribution that matches real capture, altitude, oblique angle, seasonal reflectance, and print-and-recapture noise.
- Report suppression rate and confidence drop, not just a binary 'evaded'.
- Quantify physical realizability: how much of the effect survives the transforms the attack was not trained on.
This is exactly the workflow Mirage Atlas operationalizes. The point is not to produce a striking demo of a vanishing object; it is to produce a defensible measurement of how a specific model degrades under conditions an operator will actually see, and then to feed that measurement into hardening.